Improper neutralization of user input in the Global Gallery WordPress plugin allows attackers to inject malicious JavaScript into web pages that are rendered back to the user. This reflected XSS flaw corresponds to CWE‑79 and can be used to deface the site, steal credentials, or hijack user sessions by executing code in the victim’s browser.

Affected systems are installations of the NotFound Global Gallery plugin for WordPress running any version from the earliest release through 8.8.0. The vulnerability is present in all of these versions, so any site that has not upgraded past 8.8.0 is at risk.

The CVSS score of 7.1 indicates a high impact with an attack requiring user interaction. The current EPSS score of less than 1% suggests that widespread exploitation has not been observed, and the vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the potential for credential theft and defacement makes it a priority to address, ideally by deploying an official fix or removing the plugin until one becomes available. The likely attack vector is a crafted URL or form input that is reflected unchanged in the page output.